workflow-housekeep
Warn
Audited by Gen Agent Trust Hub on Jul 24, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes various system commands and package managers based on auto-detected tech stacks (npm, pnpm, yarn, bun, pip, poetry, cargo, go, etc.) to audit and update project dependencies.
- [EXTERNAL_DOWNLOADS]: The skill triggers the download and installation of external software packages from official registries and uses the
firecrawl_searchtool to fetch migration guides and best practices from the web. - [DATA_EXFILTRATION]: The skill performs broad file system scanning, specifically targeting sensitive configuration files such as
.env,.env.local, and.env.production. While the stated intent is to identify and remove accidentally committed secrets, the skill gains read access to potentially unencrypted credentials. - [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface by processing untrusted data from the repository it is analyzing.
- Ingestion points: Reads entire repository contents including source code, READMEs, logs, and configuration files.
- Boundary markers: None present to distinguish between instructions and data during processing.
- Capability inventory: Possesses significant capabilities including file deletion (Phase 2), shell command execution (Phase 3), and network search operations (Phase 3/4).
- Sanitization: No explicit sanitization or validation of the ingested repository content is mentioned before it influences agent actions.
Audit Metadata